MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c26f13f6060a93c8dc58e99f05b71f2208a5ff3b80ac8f7acfb22002ffbb83d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loki


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c26f13f6060a93c8dc58e99f05b71f2208a5ff3b80ac8f7acfb22002ffbb83d3
SHA3-384 hash: 979d689334b7c932898d51add5a7a28fea0e5db0ba7d50a029a6f692b07bf6b369e7a4de98f23cf94bd4473c91a0c05b
SHA1 hash: 533006125b823b1c8b8852e93a629052f1d29ed4
MD5 hash: 1abb5bb6769a6247c9e07c0551e130bc
humanhash: carbon-louisiana-pizza-football
File name:SKMBT_28320062618070.zip
Download: download sample
Signature Loki
Create hunting rule
File size:230'657 bytes
First seen:2020-06-30 12:16:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:tf3ybt9jr91ToQqOMZRmCZXXy67RpXoj1ula5zwOZW9uAQi3un:N3yZ9jr91ToVgOC67Rto5uloTW5Vs
TLSH 693423076D2DCAA14B19F46DBF35FDDCDA677F623829A22E93421E39DA3C41441239C4
Reporter abuse_ch
Tags:Loki zip


Avatar
abuse_ch
Malspam distributing Loki:

HELO: seo.seoera.net
Sending IP: 192.254.138.161
From: Marzia Seletti <marzia.seletti@arix.it>
Subject: Statement of Pending Payment since April 2020
Attachment: SKMBT_28320062618070.zip (contains "SKMBT_28320062618070.exe")

Loki C2:
http://nightmarefile.ga/Jay/fre.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.24271.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c26f13f6060a93c8dc58e99f05b71f2208a5ff3b80ac8f7acfb22002ffbb83d3/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 12:18:05 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yjxrh5qgbkj4rxcy5gpqlny7eiekl7z3qcwi66wpwiqaf753qpjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loki

zip c26f13f6060a93c8dc58e99f05b71f2208a5ff3b80ac8f7acfb22002ffbb83d3

(this sample)

Loki

Executable exe bd6db82e76d317027f409e907b46cc03a4c9591d175bcf03164c98f3e50d6aed

  
Dropping
MD5 beed61c6f7049b8775e2f2a56290e402
  
Dropping
Loki
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd6db82e76d317027f409e907b46cc03a4c9591d175bcf03164c98f3e50d6aed

Comments